Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 17:47

General

  • Target

    3b567d9c4e2d5231909895b8f322c05b_JaffaCakes118.exe

  • Size

    8.3MB

  • MD5

    3b567d9c4e2d5231909895b8f322c05b

  • SHA1

    79259bc14ca25da323c781b0cc5f1a667005199e

  • SHA256

    0acb5e272dbc9821aa1ef668bc2f60489d25e5e50761e7dfefe02064cab5eb17

  • SHA512

    44853f0184164aafc6ad5fd99026ee8745ad046bfe2d9dc329379b9852a9350985b504c8e2899d8e1acdb78c7c7755ad4d8289a31161205495344b229fb163c8

  • SSDEEP

    49152:Up+fhpBIWwWdlpoSONbxVHkqKtp5CsyTnz58ZYMPSIi3w6UK4Xb1OFO4b2FhDTTY:UpJ/pKtp5ChzrgbMF1iPPrBWRd

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b567d9c4e2d5231909895b8f322c05b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3b567d9c4e2d5231909895b8f322c05b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Roaming\MacromediaFlesh\MacromediaFlesh.exe
      "C:\Users\Admin\AppData\Roaming\MacromediaFlesh\MacromediaFlesh.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\MacromediaFlesh\funcs.dll

    Filesize

    1.2MB

    MD5

    56cc386c450151906018243234ac705e

    SHA1

    4594db6817a3f2f2c16c85dee56d63b7349d451d

    SHA256

    722b1fc4ecb46f8b81ed9d1771877f9d56343d2075d932a07e756577dc9ac89f

    SHA512

    8188adacc032185686f3935666f64d49d1d0b55ca3837bff1277da5fcc4b5bdcba50b0bdfa41f5ff11ba0a3dfebda735e567b1cada7608b4aed091cc806f4811

  • \Users\Admin\AppData\Roaming\MacromediaFlesh\MacromediaFlesh.exe

    Filesize

    8.3MB

    MD5

    3b567d9c4e2d5231909895b8f322c05b

    SHA1

    79259bc14ca25da323c781b0cc5f1a667005199e

    SHA256

    0acb5e272dbc9821aa1ef668bc2f60489d25e5e50761e7dfefe02064cab5eb17

    SHA512

    44853f0184164aafc6ad5fd99026ee8745ad046bfe2d9dc329379b9852a9350985b504c8e2899d8e1acdb78c7c7755ad4d8289a31161205495344b229fb163c8

  • memory/1744-37-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-22-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-16-0x0000000003CD0000-0x0000000003E0F000-memory.dmp

    Filesize

    1.2MB

  • memory/1744-857-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-19-0x0000000003CD0000-0x0000000003E0F000-memory.dmp

    Filesize

    1.2MB

  • memory/1744-18-0x0000000000400000-0x0000000000C4D000-memory.dmp

    Filesize

    8.3MB

  • memory/1744-58-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-40-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-39-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-38-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-12-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/1744-859-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-784-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-56-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-164-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/1744-701-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-57-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-786-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-785-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-783-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-782-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1744-858-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/1996-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1996-11-0x0000000000400000-0x0000000000C4D000-memory.dmp

    Filesize

    8.3MB